refactor: switch openclaw and hermes to their official images

openclaw/.env.example

@@ -2,19 +2,20 @@
 #
 #   cp .env.example .env
 
-# Web UI login.
-# Generate a password with: openssl rand -base64 24
-AUTH_USERNAME=admin
-AUTH_PASSWORD=
-
-# Token for the agent gateway. Generate one with: openssl rand -hex 32
+# Gateway token: the Control UI login and the key for every API and WebSocket call.
+# Generate one with: openssl rand -hex 32
 OPENCLAW_GATEWAY_TOKEN=
 
-# At least one provider key is required; OpenRouter is the active one.
+# Public origin of the Control UI, scheme included, no trailing slash.
+OPENCLAW_PUBLIC_ORIGIN=https://openclaw.example.com
+
+# Address range the reverse proxy connects from, in CIDR form.
+OPENCLAW_TRUSTED_PROXIES=10.0.0.0/16
+
+# At least one model provider; OpenRouter is the active one.
 OPENROUTER_API_KEY=
 
-# Default model, e.g. openrouter/anthropic/claude-sonnet-4.5.
-# OPENCLAW_PRIMARY_MODEL=
+TZ=Asia/Ho_Chi_Minh
 
 # Other providers. Uncomment here and in compose.yml to enable one.
 # ANTHROPIC_API_KEY=
@@ -26,9 +27,7 @@ OPENROUTER_API_KEY=
 # CEREBRAS_API_KEY=
 # VENICE_API_KEY=
 # MOONSHOT_API_KEY=
-# MOONSHOT_BASE_URL=https://api.moonshot.ai/v1
 # KIMI_API_KEY=
-# KIMI_BASE_URL=https://api.moonshot.ai/anthropic
 # MINIMAX_API_KEY=
 # ZAI_API_KEY=
 # AI_GATEWAY_API_KEY=
@@ -36,6 +35,7 @@ OPENROUTER_API_KEY=
 # SYNTHETIC_API_KEY=
 # COPILOT_GITHUB_TOKEN=
 # XIAOMI_API_KEY=
+# OLLAMA_API_KEY=
 # Speech to text.
 # DEEPGRAM_API_KEY=
 # AWS Bedrock.
@@ -43,27 +43,9 @@ OPENROUTER_API_KEY=
 # AWS_SECRET_ACCESS_KEY=
 # AWS_SESSION_TOKEN=
 # AWS_REGION=us-east-1
-# BEDROCK_PROVIDER_FILTER=anthropic
-# OLLAMA_BASE_URL=
 
 # Chat channels.
 # TELEGRAM_BOT_TOKEN=
 # DISCORD_BOT_TOKEN=
 # SLACK_BOT_TOKEN=
 # SLACK_APP_TOKEN=
-# WHATSAPP_ENABLED=
-
-# Gateway, browser and hook tuning.
-# Origins allowed to open the control UI, comma separated, e.g. https://openclaw.example.com.
-# OPENCLAW_ALLOWED_ORIGINS=
-# OPENCLAW_GATEWAY_BIND=loopback
-# BROWSER_DEFAULT_PROFILE=openclaw
-# BROWSER_EVALUATE_ENABLED=true
-# BROWSER_SNAPSHOT_MODE=efficient
-# BROWSER_REMOTE_TIMEOUT_MS=1500
-# BROWSER_REMOTE_HANDSHAKE_TIMEOUT_MS=3000
-# HOOKS_ENABLED=false
-# HOOKS_PATH=/hooks
-
-# Extra apt packages installed into the container at start, space separated.
-# OPENCLAW_DOCKER_APT_PACKAGES=